[Qemu-devel] [PATCH] Add support for r6040 NIC

[bifferos]

Signed-off-by: Mark Kelly <address@hidden>
diff --git a/Makefile.objs b/Makefile.objs
index 6991a9f..7d87503 100644
--- a/Makefile.objs
+++ b/Makefile.objs
@@ -240,6 +240,7 @@ hw-obj-$(CONFIG_PCNET_PCI) += pcnet-pci.o
 hw-obj-$(CONFIG_PCNET_COMMON) += pcnet.o
 hw-obj-$(CONFIG_E1000_PCI) += e1000.o
 hw-obj-$(CONFIG_RTL8139_PCI) += rtl8139.o
+hw-obj-$(CONFIG_R6040_PCI) += r6040.o
 
 hw-obj-$(CONFIG_SMC91C111) += smc91c111.o
 hw-obj-$(CONFIG_LAN9118) += lan9118.o
diff --git a/default-configs/pci.mak b/default-configs/pci.mak
index 22bd350..d2ea7a2 100644
--- a/default-configs/pci.mak
+++ b/default-configs/pci.mak
@@ -10,6 +10,7 @@ CONFIG_PCNET_PCI=y
 CONFIG_PCNET_COMMON=y
 CONFIG_LSI_SCSI_PCI=y
 CONFIG_RTL8139_PCI=y
+CONFIG_R6040_PCI=y
 CONFIG_E1000_PCI=y
 CONFIG_IDE_CORE=y
 CONFIG_IDE_QDEV=y
diff --git a/hw/pci.c b/hw/pci.c
index b904a4e..7e12935 100644
--- a/hw/pci.c
+++ b/hw/pci.c
@@ -1527,6 +1527,7 @@ static const char * const pci_nic_models[] = {
     "rtl8139",
     "e1000",
     "pcnet",
+    "r6040",
     "virtio",
     NULL
 };
@@ -1539,6 +1540,7 @@ static const char * const pci_nic_names[] = {
     "rtl8139",
     "e1000",
     "pcnet",
+    "r6040",
     "virtio-net-pci",
     NULL
 };
diff --git a/hw/r6040.c b/hw/r6040.c
new file mode 100644
index 0000000..83587e7
--- /dev/null
+++ b/hw/r6040.c
@@ -0,0 +1,627 @@
+/*
+   Emulation of r6040 ethernet controller found in a number of SoCs.
+   Copyright (c) 2011 Mark Kelly, address@hidden
+
+   This has been written using the R8610[1] and ip101a[2] datasheets.
+
+   ICs with the embedded controller include R8610, R3210, AMRISC20000
+   and Vortex86SX
+
+   The emulation seems good enough to fool Linux 2.6.37.6.  It is
+   not perfect, but has proven useful.
+
+   [1] http://www.sima.com.tw/download/R8610_D06_20051003.pdf
+   [2] http://www.icplus.com.tw/pp-IP101A.html
+ */
+
+#include "hw.h"
+#include "pci.h"
+#include "net.h"
+#include "loader.h"
+#include "sysemu.h"
+#include "qemu-timer.h"
+
+/* #define DEBUG_R6040 1 */
+
+
+#if defined DEBUG_R6040
+#define DPRINTF(fmt, ...) \
+    do { fprintf(stderr, "R6040: " fmt, ## __VA_ARGS__); } while (0)
+#else
+static inline GCC_FMT_ATTR(1, 2) int DPRINTF(const char *fmt, ...)
+{
+    return 0;
+}
+#endif
+
+
+/* Cast in order of appearance.  _W prevfix means it's used to index the
+   register word array (RegsW)
+ */
+
+#define MPSCCR_W         (0x88 / 2)
+
+#define MAC0_W           (0x68 / 2)
+#define MAC1_W           (0x6a / 2)
+#define MAC2_W           (0x6c / 2)
+
+
+#define RX_START_LOW_W   (0x34 / 2)
+#define RX_START_HIGH_W  (0x38 / 2)
+#define TX_PKT_COUNT_W   (0x5a / 2)
+#define RX_PKT_COUNT_W   (0x50 / 2)
+
+
+#define MCR0_W           (0x00 / 2)
+#define MCR1_W           (0x04 / 2)
+#define BIT_MRST         (1 << 0)
+
+#define MTPR_W           (0x14 / 2)
+#define MRBSR_W          (0x18 / 2)
+#define MISR_W           (0x3c / 2)
+#define MIER_W           (0x40 / 2)
+
+#define MMDIO_W          (0x20 / 2)
+#define MDIO_READ_W      (0x24 / 2)
+#define MDIO_WRITE_W     (0x28 / 2)
+
+#define MRCNT_W          (0x50 / 2)
+#define MTCNT_W          (0x5c / 2)
+
+
+#define MDIO_WRITE      0x4000
+#define MDIO_READ       0x2000
+
+
+typedef struct R6040State {
+    PCIDevice dev;
+    NICState *nic;
+    NICConf conf;
+
+    /* PHY related register sets */
+    uint16_t MID0[3];
+    uint16_t phy_regs[32];
+    uint32_t phy_op_in_progress;
+
+    /* Primary IO address space */
+    union {
+        uint8_t RegsB[0x100];   /* Byte access */
+        uint16_t RegsW[0x100/2];  /* word access */
+        uint32_t RegsL[0x100/4];  /* DWORD access */
+    };
+
+} R6040State;
+
+
+/* some inlines to help access above structure */
+static inline uint32_t TX_START(R6040State *s)
+{
+    uint32_t tmp = s->RegsW[0x2c/2];
+    return tmp | (s->RegsW[0x30/2] << 16);
+}
+
+static inline void TX_START_SET(R6040State *s, uint32_t start)
+{
+    s->RegsW[0x2c/2] = start & 0xffff;
+    s->RegsW[0x30/2] = (start >> 16) & 0xffff;
+}
+
+static inline uint32_t RX_START(R6040State *s)
+{
+    uint32_t tmp = s->RegsW[0x34/2];
+    return tmp | (s->RegsW[0x38/2] << 16);
+}
+
+static inline void RX_START_SET(R6040State *s, uint32_t start)
+{
+    s->RegsW[0x34/2] = start & 0xffff;
+    s->RegsW[0x38/2] = (start >> 16) & 0xffff;
+}
+
+
+static void r6040_update_irq(R6040State *s)
+{
+    uint16_t isr = s->RegsW[MISR_W] & s->RegsW[MIER_W];
+
+    qemu_set_irq(s->dev.irq[0], isr ? 1 : 0);
+}
+
+
+/* Mark auto-neg complete, NIC up.  */
+static void PhysicalLinkUp(void *opaque)
+{
+    R6040State *s = opaque;
+    s->phy_regs[1] |= (1 << 2);
+}
+
+
+/* Transmit and receive descriptors are doubled up
+   One is a subset of the other anyhow
+ */
+typedef struct descriptor {
+    uint16_t DST;
+    uint16_t DLEN;
+    uint32_t DBP;
+    uint32_t DNX;
+    uint16_t HIDX;
+    uint16_t Reserved1;
+    uint16_t Reserved2;
+} descriptor_t;
+
+
+/* Some debugging functions */
+
+#ifdef DEBUG_R6040
+static void addr_dump16(const char *name, uint16_t val)
+{
+    DPRINTF("%s: 0x%04x  ", name, val);
+}
+
+static void addr_dump32(const char *name, uint32_t val)
+{
+    DPRINTF("%s: 0x%x  ", name, val);
+}
+
+static void hex_dump(const uint8_t *data, uint32_t len)
+{
+    uint8_t i;
+    DPRINTF("hex: ");
+    for (i = 0; i < len; i++) {
+        fprintf(stderr, "%02x ", *data);
+        if (i && !(i % 0x20)) {
+            fprintf(stderr, "\n");
+        }
+        data++;
+    }
+    fprintf(stderr, "\n");
+}
+
+static void desc_dump(descriptor_t *d, uint32_t addr)
+{
+    DPRINTF("\nDumping: 0x%x\n", addr);
+    addr_dump16("DST", d->DST);
+    addr_dump16("DLEN", d->DLEN);
+    addr_dump32("DBP", (unsigned long)d->DBP);
+    addr_dump32("DNX", (unsigned long)d->DNX);
+    addr_dump16("HIDX", d->HIDX);
+    printf("\n");
+}
+
+static void dump_phys_mem(uint32_t addr, int len)
+{
+    uint8_t buffer[1024];
+    cpu_physical_memory_read(addr, buffer, len);
+    hex_dump(buffer, len);
+}
+
+static void dump_pci(uint8_t *pci_conf)
+{
+    uint32_t *p = (uint32_t *)pci_conf;
+    int i = 0;
+    for (i = 0; i < 0x40; i += 4) {
+        DPRINTF("Addr: 0x%08x,  Data: 0x%08x\n", i, *p);
+        p++;
+    }
+}
+#endif
+
+
+static const VMStateDescription vmstate_r6040 = {
+    .name = "r6040",
+    .version_id = 3,
+    .minimum_version_id = 2,
+    .minimum_version_id_old = 2,
+    .fields = (VMStateField[]) {
+        VMSTATE_PCI_DEVICE(dev, R6040State),
+        VMSTATE_BUFFER(RegsB, R6040State),
+        VMSTATE_UINT16_ARRAY(MID0, R6040State, 3),
+        VMSTATE_UINT16_ARRAY(phy_regs, R6040State, 32),
+        VMSTATE_UINT32(phy_op_in_progress, R6040State),
+        VMSTATE_MACADDR(conf.macaddr, R6040State),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
+
+static int TryToSendOnePacket(void *opaque)
+{
+    R6040State *s = opaque;
+    descriptor_t d;
+    uint8_t pkt_buffer[2000];
+    uint32_t tocopy;
+
+    cpu_physical_memory_read(TX_START(s), (uint8_t *)&d, sizeof(d));
+
+    if (d.DST & 0x8000) {    /* MAC owns it?  */
+        tocopy = d.DLEN;
+        if (tocopy > sizeof(pkt_buffer)) {
+            tocopy = sizeof(pkt_buffer);
+        }
+        /* copy the packet to send it */
+        cpu_physical_memory_read(d.DBP, pkt_buffer, tocopy);
+
+        qemu_send_packet(&s->nic->nc, pkt_buffer, tocopy);
+        s->RegsW[TX_PKT_COUNT_W]++;
+
+        /* relinquish ownership, we're done with it */
+        d.DST &= ~0x8000;
+
+        /* Copy the new version of the descriptor back */
+        cpu_physical_memory_write(TX_START(s), (uint8_t *)&d, sizeof(d));
+
+        /* Advance to the next buffer if packet processed */
+        TX_START_SET(s, d.DNX);
+
+        return 1;
+    }
+
+    return 0;
+}
+
+
+static void r6040_transmit(void *opaque)
+{
+    R6040State *s = opaque;
+    int count = 0;
+
+    while (TryToSendOnePacket(s)) {
+        ++count;
+    }
+
+    if (count) {
+        s->RegsW[MISR_W] |= 0x10;
+        r6040_update_irq(s);
+    }
+}
+
+
+/* Whether to allow callback returning 1 for yes, can receive */
+static int r6040_can_receive(VLANClientState *nc)
+{
+    R6040State *s = DO_UPCAST(NICState, nc, nc)->opaque;
+    int tmp = (s->RegsW[0] & (1 << 1)) ? 1 : 0;
+    return tmp;
+}
+
+
+static int ReceiveOnePacket(void *opaque, const uint8_t *buf, size_t len)
+{
+    R6040State *s = opaque;
+    uint32_t tocopy = len+4;  /* include checksum */
+    descriptor_t d;
+
+    cpu_physical_memory_read(RX_START(s), (uint8_t *)&d, sizeof(descriptor_t));
+    /*desc_dump(&d, 0);*/
+
+    if (d.DST & 0x8000) {    /* MAC owned? */
+
+        uint16_t max_buffer = s->RegsW[MRBSR_W] & 0x07fc;
+        if (tocopy > max_buffer) {
+            tocopy = max_buffer;
+        }
+
+        cpu_physical_memory_write(d.DBP, buf, tocopy-4);
+
+        /* indicate received OK */
+        d.DST |= (1 << 14);
+        d.DLEN = tocopy;
+        /* relinquish ownership */
+        d.DST &= ~0x8000;
+
+        /* Copy the descriptor back */
+        cpu_physical_memory_write(RX_START(s), (uint8_t *)&d,
+                                   sizeof(descriptor_t));
+
+        s->RegsW[RX_PKT_COUNT_W]++;
+
+        s->RegsW[MISR_W] |= 1;  /* received pkt interrupt */
+
+        r6040_update_irq(s);
+
+        RX_START_SET(s, d.DNX);  /* advance */
+
+        return 0;
+    }
+    return -1;
+}
+
+
+/* called on incoming packets */
+static ssize_t r6040_receive(VLANClientState *nc, const uint8_t *buf,
+                                        size_t len)
+{
+    R6040State *s = DO_UPCAST(NICState, nc, nc)->opaque;
+    DPRINTF("Received incoming packet of len %ld\n", len);
+
+    if (0 == ReceiveOnePacket(s, buf, len)) {
+        return len;  /* copied OK */
+    }
+
+    return 0;
+}
+
+
+static void r6040_cleanup(VLANClientState *vc)
+{
+    DPRINTF("r6040_cleanup\n");
+}
+
+
+static inline int BIT_SET(uint16_t old, uint16_t new, uint16_t bit)
+{
+    uint16_t before = (old & (1 << bit));
+    uint16_t after = (new & (1 << bit));
+    if (!before && after) {
+        return 1;
+    }
+    return 0;
+}
+
+
+static void r6040_ioport_writew(void *opaque, uint32_t addr, uint32_t val)
+{
+    R6040State *s = opaque;
+    uint16_t old;
+    addr &= 0xff;   /* get relative to base address */
+    addr /= 2;    /* Get the offset into the word-array */
+    old = s->RegsW[addr];   /* store the old value for future use */
+
+    switch (addr) {
+    case MCR0_W:   /* 0x00 */
+        if (BIT_SET(old, val, 12)) {
+            r6040_transmit(opaque);
+        }
+        break;
+    case MCR1_W:  /* 0x04 */
+        if (val & BIT_MRST) {   /* reset request incoming */
+            /* reset requested, complete it immediately, set this value to
+               default */
+            val = 0x0010;
+        }
+        break;
+    case MTPR_W:  /* TX command reg, 0x14 */
+        if (val & 1) {
+            r6040_transmit(opaque);
+            val &= ~1;
+        }
+        break;
+    case MMDIO_W:  /* MDIO control, 0x20 */
+        {
+            int phy_exists = ((val & 0x1f00) == 0x100) ? 1 : 0;
+            uint16_t *phy = s->phy_regs;
+            phy += (val & 0x1f);
+
+            if  (val & (1 << 13)) {   /* read data */
+                if (phy_exists) {
+                    s->RegsW[MDIO_READ_W] = *phy;
+                } else {
+                    s->RegsW[MDIO_READ_W] = 0xffff;
+                }
+            } else if (val & (1 << 14)) {  /* write data */
+                if (phy_exists) {
+                    *phy = s->RegsW[MDIO_WRITE_W];
+                }
+            }
+
+            /* Whether you request to read or write, both bits go high while
+               the operation is in progress, e.g. tell it to read, and the
+               write-in-progress flag also goes high */
+            val |= 0x6000;  /* signal operation has started */
+            s->phy_op_in_progress = 1;
+
+            break;
+        }
+    case MISR_W:  /* interrupt status reg (read to clear), 0x3c */
+        return;
+
+    case MIER_W:  /* interrupt enable register, 0x40 */
+        s->RegsW[MIER_W] = val;
+        r6040_update_irq(s);
+        return;
+
+    case MRCNT_W:   /* 0x50 */
+    case MTCNT_W:   /* 0x5c */
+        return;  /* Can't write to pkt count registers, skip */
+
+    }
+    s->RegsW[addr] = val & 0xFFFF;
+}
+
+
+
+static uint32_t r6040_ioport_readw(void *opaque, uint32_t addr)
+{
+    R6040State *s = opaque;
+    addr &= 0xff;   /* get relative to base address */
+    addr /= 2;    /* Get the offset into the word-array */
+    uint32_t tmp = s->RegsW[addr];  /* get the value */
+
+    switch (addr) {
+
+    case MMDIO_W:  /* MDIO control, 0x20 */
+        {
+            /* Clear any in-progress MDIO activity for the next read
+               This simulates the polling of the MDIO operation status,
+               so the driver code always has to read the register twice
+               before it thinks the operation is complete. */
+            if (s->phy_op_in_progress) {
+                s->RegsW[addr] &= ~0x6000;
+                s->phy_op_in_progress = 0;
+            }
+            break;
+        }
+    case MISR_W:  /* interrupt status reg (read to clear)  0x3c */
+        s->RegsW[addr] = 0;
+        break;
+    case MIER_W:  /* interrupt enable reg 0x40 */
+        break;
+    case MRCNT_W:  /* 0x50 */
+    case MTCNT_W:  /* 0x5c */
+        s->RegsW[addr] = 0;   /* read to clear */
+        break;
+    default:
+        break;
+    }
+    return tmp;
+}
+
+
+/* byte and long access are routed via the word operation handlers */
+static void r6040_ioport_writeb(void *opaque, uint32_t addr, uint32_t val)
+{
+    R6040State *s = opaque;
+    addr &= 0xFF;
+    val &= 0xFF;
+    uint16_t old = s->RegsW[addr/2];  /* get the current value */
+    if (addr & 1) {
+        old &= 0xff;
+        old |= (val << 8);
+    } else {
+        old &= 0xff00;
+        old |= val;
+    }
+
+    r6040_ioport_writew(opaque, addr, old);  /* call the word-based version */
+}
+
+static void r6040_ioport_writel(void *opaque, uint32_t addr, uint32_t val)
+{
+    /* Set the low value */
+    r6040_ioport_writew(opaque, addr, val & 0xffff);
+    /* Set the high value */
+    r6040_ioport_writew(opaque, addr+2, (val >> 16) & 0xffff);
+}
+
+static uint32_t r6040_ioport_readb(void *opaque, uint32_t addr)
+{
+    uint32_t tmp = r6040_ioport_readw(opaque, addr & ~1);
+    if (addr & 1) {
+        return (tmp & 0xff00) >> 8;
+    }
+    return tmp & 0xff;
+}
+
+static uint32_t r6040_ioport_readl(void *opaque, uint32_t addr)
+{
+    uint32_t tmp = r6040_ioport_readw(opaque, addr);
+    return tmp | (r6040_ioport_readw(opaque, addr+2) << 16);
+}
+
+
+static void r6040_register_ioports(R6040State *s, pcibus_t addr)
+{
+    register_ioport_write(addr, 0x100, 1, r6040_ioport_writeb, s);
+    register_ioport_read(addr, 0x100, 1, r6040_ioport_readb,  s);
+
+    register_ioport_write(addr, 0x100, 2, r6040_ioport_writew, s);
+    register_ioport_read(addr, 0x100, 2, r6040_ioport_readw,  s);
+
+    register_ioport_write(addr, 0x100, 4, r6040_ioport_writel, s);
+    register_ioport_read(addr, 0x100, 4, r6040_ioport_readl,  s);
+}
+
+
+static void r6040_map(PCIDevice *pci_dev, int region_num,
+                       pcibus_t addr, pcibus_t size, int type)
+{
+    R6040State *s = DO_UPCAST(R6040State, dev, pci_dev);;
+
+    DPRINTF("## Mapping to address %lx\n", addr);
+    r6040_register_ioports(s, addr);
+}
+
+
+static NetClientInfo net_r6040_info = {
+    .type = NET_CLIENT_TYPE_NIC,
+    .size = sizeof(NICState),
+    .can_receive = r6040_can_receive,
+    .receive = r6040_receive,
+    .cleanup = r6040_cleanup,
+};
+
+
+static int r6040_init_pci(PCIDevice *dev)
+{
+    QEMUTimer *timer;
+
+    R6040State *s = DO_UPCAST(R6040State, dev, dev);
+    uint8_t *pci_conf;
+
+    /* MAC PHYS status change register.  Linux driver expects something
+       sensible as default and if not will try to set it */
+    s->RegsW[MPSCCR_W] = 0x9f07;
+
+    /* Default value for maximum packet size */
+    s->RegsW[MRBSR_W] = 0x600;
+
+    /* set the MAC, linux driver reads this when it loads, it is
+       normally set by the BIOS, but obviously Qemu BIOS isn't going
+       to do that */
+    s->RegsW[MAC0_W] = 0x5452;
+    s->RegsW[MAC1_W] = 0x1200;
+    s->RegsW[MAC2_W] = 0x5734;
+
+    /* Tell Qemu the same thing */
+    s->conf.macaddr.a[0] = s->RegsW[MAC0_W] & 0xff;
+    s->conf.macaddr.a[1] = (s->RegsW[MAC0_W] >> 8) & 0xff;
+    s->conf.macaddr.a[2] = s->RegsW[MAC1_W] & 0xff;
+    s->conf.macaddr.a[3] = (s->RegsW[MAC1_W] >> 8) & 0xff;
+    s->conf.macaddr.a[4] = s->RegsW[MAC2_W] & 0xff;
+    s->conf.macaddr.a[5] = (s->RegsW[MAC2_W] >> 8) & 0xff;
+
+    /* no commands running */
+    s->phy_op_in_progress = 0;
+
+    /* PHY auto-neg in progress */
+    s->phy_regs[1] = 0x786d & ~(1 << 2);
+    s->phy_regs[2] = 0x0243;
+    s->phy_regs[3] = 0x0c54;
+
+    pci_conf = (uint8_t *)s->dev.config;
+
+    pci_conf[PCI_HEADER_TYPE] = PCI_HEADER_TYPE_NORMAL; /* header_type */
+    pci_conf[PCI_INTERRUPT_LINE] = 0xa;     /* interrupt line  */
+    pci_conf[PCI_INTERRUPT_PIN] = 1;      /* interrupt pin 0 */
+
+    pci_register_bar(&s->dev, 0, 0x100, PCI_BASE_ADDRESS_SPACE_IO, r6040_map);
+
+    s->nic = qemu_new_nic(&net_r6040_info, &s->conf,
+                            dev->qdev.info->name, dev->qdev.id, s);
+
+    qemu_format_nic_info_str(&s->nic->nc, s->conf.macaddr.a);
+
+    /* Simulate a delay of a couple of seconds for the link to come up.
+       Not required for Linux but very handy for developing BIOS code.
+     */
+    timer = qemu_new_timer_ns(vm_clock, PhysicalLinkUp, s);
+    qemu_mod_timer(timer, qemu_get_clock_ms(vm_clock) + 1500000000);
+
+    /* Register IO port access as well */
+    r6040_register_ioports(s, 0xe800);
+
+    return 0;
+}
+
+
+static PCIDeviceInfo r6040_info = {
+    .qdev.name = "r6040",
+    .qdev.size = sizeof(R6040State),
+    .qdev.vmsd  = &vmstate_r6040,
+    .init      = r6040_init_pci,
+    .vendor_id = 0x17f3,  /* RDC */
+    .device_id = 0x6040,   /* r6040 nic */
+    .class_id   = PCI_CLASS_NETWORK_ETHERNET,
+    .qdev.props = (Property[]) {
+        DEFINE_NIC_PROPERTIES(R6040State, conf),
+        DEFINE_PROP_END_OF_LIST(),
+    }
+};
+
+
+static void r6040_register(void)
+{
+    pci_qdev_register(&r6040_info);
+}
+
+
+device_init(r6040_register)